CVE-2024-1156 is a High severity directory permission flaw, scored 7.8, in the shared NI RabbitMQ service. A local authenticated user may read RabbitMQ configuration and potentially escalate privileges. NI says to upgrade SystemLink Server to 2024 Q1 or later, or restrict folder access.
What's affected
NI's advisory lists these products as affected: SystemLink Server 2023 Q3 and prior, FlexLogger 2022 Q3 and prior, G Web Development Software (all editions) 2022 Q3 and prior, Static Test Software Suite 1.2 and prior, LabVIEW NXG 5.1 (Web Module, Real-Time Module and Community Edition), Data Record AD 2.0.1 and prior, STS Software Bundle 21.0 and prior, and Specification Compliance Manager 2023 Q4 and prior.
The record says incorrect directory permissions for the shared NI RabbitMQ service may allow a local authenticated user to read RabbitMQ configuration information and potentially escalate privileges. It is the sibling of CVE-2024-1155 and the same NI advisory covers both.
The only fixed version NI names is SystemLink Server 2024 Q1 or later. For the other products it lists no fixed version and points to a mitigation. One oddity: the NVD record's product entries use Emerson as the vendor name for these NI products. I followed NI's advisory for the product list.
How to check if you're exposed
Check which of the listed NI products are installed. In the NI Package Manager, the installed packages and versions are listed. On Windows you can also look under Apps and features.
Then inspect the folders named in the advisory under Program Files\National Instruments\Shared\Skyline and ProgramData\National Instruments\Skyline\RabbitMQ. If the Users or Authenticated Users groups have access through inherited permissions, the host is exposed.
What to do now
- List hosts running SystemLink Server or the other affected NI software.
- Upgrade SystemLink Server to 2024 Q1 or later. NI strongly recommends this, via NI Package Manager or NI Software Downloads.
- If you cannot upgrade, run NI's systemlink-restrict-file-access.bat script as administrator for each directory that exists, or disable inheritance on each folder and remove the Users and Authenticated Users entries.
- Reboot the server afterwards, as NI instructs.
- For FlexLogger with SystemLink Server installed, upgrade SystemLink Server instead.
- Limit who has local accounts on these machines.
Why it matters
The classes are incorrect default permissions, CWE-276, and incorrect authorization, CWE-863. The RabbitMQ configuration can hold credentials and service settings, so reading it is the first step toward higher privileges.
The fix is the same as for the sibling CVE: upgrade or tighten folder permissions. Do both CVEs in one change. The record's KEV flag is false.
Quick check
Is there a fix for every affected product?
No. NI names a fixed version only for SystemLink Server (2024 Q1 or later). For the others it gives a permissions mitigation.
Does an attacker need to be local?
Yes. The record describes local access by an authenticated user.
Sources
- NI security advisory on incorrect permissions in SystemLink Elixir based services
- NVD record and references for CVE-2024-1156
Last reviewed: 19 October 2026.
